Passwords and sessions are different things
A password, passkey or federated assertion helps establish identity. A session represents an active period in which the product is willing to accept requests from that identity. Revoking the session is therefore the direct control when access must stop immediately.
Waiting for a password reset can be slower, broader and less precise than ending the specific product session that is no longer trusted.
Revocation should be observable
After revocation, a previously allowed read should fail for that session. The failure should be distinguishable from a missing resource or an unrelated policy denial so support and security teams can understand what happened.
New authentication can then create a new session under the organisation’s current rules if access should be restored.
External shares remain separate
Session revocation also illustrates why external sharing should not be attached to employee credentials. Ending a staff session should not require hunting through anonymous links, and restoring staff access should not silently restore an external recipient relationship.
Each access path needs its own lifecycle and audit context.
In the organisation-admin console, sessions for that tenant can be listed and revoked. Disabling a member also revokes that person’s active product sessions for the organisation. The last remaining organisation admin cannot be disabled, so a tenant cannot lock itself out of recovery.
End the session in the product
Revoke should take effect without waiting for the access token to expire. Confirm previously permitted work stops, and that the event remains in the product record.